AWS iot-sitewise medium security documentation change
Summary
Replaced manual EMQX REST API curl commands with AWS IoT SiteWise EMQX CLI tool for admin password changes and user management, simplifying the process and enforcing secure practices.
Security assessment
The change enforces secure practices by replacing error-prone manual API token handling with a dedicated CLI tool, ensuring default credentials ('admin/public') are changed and reducing exposure of sensitive operations. This directly addresses risks of misconfiguration and default credential exploitation.
Diff
diff --git a/iot-sitewise/latest/userguide/configure-emqx-broker.md b/iot-sitewise/latest/userguide/configure-emqx-broker.md index 5bb9e4be9..d23cc77cd 100644 --- a//iot-sitewise/latest/userguide/configure-emqx-broker.md +++ b//iot-sitewise/latest/userguide/configure-emqx-broker.md @@ -201 +201 @@ Existing or default authorization rules apply to the new user. It's recommended -EMQX REST API with Linux +EMQX Management with Linux @@ -204 +204 @@ EMQX REST API with Linux -###### To add usernames and password through a shell environment and the EMQX broker REST APIs +Use the AWS IoT SiteWise EMQX CLI tool at `/greengrass/v2/bin/swe-emqx-cli`. @@ -206 +206 @@ EMQX REST API with Linux - 1. Ensure that the ./jq command-line processor tool is installed. If it's not, install it. For more information, see [Download jq](https://jqlang.org/download/) in the _./jq Documentation_. +###### To enable username and password authentication through EMQX Management using Linux @@ -208 +208 @@ EMQX REST API with Linux - 2. Update the default `public` password using the following command, replacing `new_admin_password` with the password of your choosing for the broker admin user. + 1. Change the admin password by running the following command: @@ -210,12 +210 @@ EMQX REST API with Linux - curl -s -X 'POST' 'http://localhost:18083/api/v5/login' -H'accept: application/json' \ - -H 'Content-Type: application/json' \ - -d '{"username": "admin", "password": "public" }' \ - | jq -r '.token' \ - | xargs -I {} curl -s -w '%{http_code}' -X 'POST' 'http://localhost:18083/api/v5/users/admin/change_pwd' \ - -H 'Authorization: Bearer {}' \ - -H 'Content-Type: application/json' \ - -d '{ - "old_pwd": "public", - "new_pwd": "new_admin_password" - }' \ - | grep -q '^2[0-9][0-9]$' && echo "Admin password changed successfully" || echo "Failed to change admin password" + /greengrass/v2/bin/swe-emqx-cli admin change-pwd @@ -223 +212 @@ EMQX REST API with Linux -If the password change is successful, the following message displays: + 2. When prompted, do the following: @@ -225 +214 @@ If the password change is successful, the following message displays: - Admin password changed successfully + 1. Enter your current administrator user (default is `admin`) and password (default is `public`). @@ -227 +216 @@ If the password change is successful, the following message displays: - 3. Add usernames and passwords for your external applications. + 2. Enter and confirm your new password. @@ -229 +218 @@ If the password change is successful, the following message displays: - * Replace `username_to_add` with the username to use on your external application. +If successful, you see the following message: @@ -231 +220 @@ If the password change is successful, the following message displays: - * Replace `password_to_add` the password to use for the username. + admin password changed successfully @@ -233 +222 @@ If the password change is successful, the following message displays: - * Replace `new_admin_password` with your updated dashboard admin password. + 3. Add users for external applications by running the following command: @@ -235,10 +224 @@ If the password change is successful, the following message displays: - curl -s -X 'POST' 'http://localhost:18083/api/v5/login' -H'accept: application/json' \ - -H 'Content-Type: application/json' \ - -d '{"username": "admin", "password": "new_admin_password" }' \ - | jq -r '.token' \ - | xargs -I {} curl -s -X 'POST' \ - 'http://localhost:18083/api/v5/authentication/password_based%3Abuilt_in_database/users' \ - -H 'accept: application/json' \ - -H 'Authorization: Bearer {}' -H 'Content-Type: application/json' \ - -d '{ "password": "password_to_add", "user_id": "username_to_add"}' \ - | jq '.' + /greengrass/v2/bin/swe-emqx-cli users add @@ -246 +226 @@ If the password change is successful, the following message displays: -If the update is successful, a message similar to this appears: + 4. When prompted, do the following: @@ -248,4 +228 @@ If the update is successful, a message similar to this appears: - { - "is_superuser": false, - "user_id": "your-added-username" - } + 1. Enter the username for the new user. @@ -253 +230 @@ If the update is successful, a message similar to this appears: -If the command fails, ensure that you're using the correct dashboard admin password that you updated in the previous step. + 2. Enter and confirm the password for the new user. @@ -254,0 +232 @@ If the command fails, ensure that you're using the correct dashboard admin passw +If successful, you see the following message: @@ -255,0 +234 @@ If the command fails, ensure that you're using the correct dashboard admin passw + User '[username]' created successfully @@ -256,0 +236 @@ If the command fails, ensure that you're using the correct dashboard admin passw + 5. Verify user configuration by running the following command: @@ -258 +238 @@ If the command fails, ensure that you're using the correct dashboard admin passw -EMQX REST API with Windows + /greengrass/v2/bin/swe-emqx-cli users list @@ -259,0 +240 @@ EMQX REST API with Windows +The output shows all configured users: @@ -261 +242,2 @@ EMQX REST API with Windows -###### To add usernames and password through PowerShell and the EMQX broker REST APIs + Users: + - [your-added-username] @@ -263 +245 @@ EMQX REST API with Windows - 1. Update the default `public` password using the following command, replacing `new-admin-password` with the password of your choosing for the broker admin user. + Total users: 1 @@ -265,3 +246,0 @@ EMQX REST API with Windows - try { - $loginResponse = Invoke-RestMethod -Uri 'http://localhost:18083/api/v5/login' -Method Post -ContentType 'application/json' -Body '{"username": "admin", "password": "public"}' - $token = $loginResponse.token @@ -269 +247,0 @@ EMQX REST API with Windows - $changePwdResponse = Invoke-RestMethod -Uri 'http://localhost:18083/api/v5/users/admin/change_pwd' -Method Post -ContentType 'application/json' -Headers @{"Authorization" = "Bearer $token"} -Body '{"old_pwd": "public", "new_pwd": "new-admin-password"}' @@ -271,4 +248,0 @@ EMQX REST API with Windows - Write-Output "Admin password changed successfully" - } catch { - Write-Output "Failed to change admin password: $_" - } @@ -276 +250 @@ EMQX REST API with Windows -If the password change is successful, the following message displays: +EMQX Management with Windows @@ -278 +251,0 @@ If the password change is successful, the following message displays: - Admin password changed successfully @@ -280 +253 @@ If the password change is successful, the following message displays: - 2. Add usernames and passwords for your external applications. +Use the AWS IoT SiteWise EMQX CLI tool at one of the following locations: @@ -282 +255 @@ If the password change is successful, the following message displays: - * Replace `username-to-add` with the username to use on your external application. + * PowerShell: `C:\greengrass\v2\bin\swe-emqx-cli.ps1` @@ -284 +257 @@ If the password change is successful, the following message displays: - * Replace `password-to-add` the password to use for the username. + * Command Prompt: `C:\greengrass\v2\bin\swe-emqx-cli.bat` @@ -286 +258,0 @@ If the password change is successful, the following message displays: - * Replace `new-admin-password` with your updated dashboard admin password. @@ -288,3 +259,0 @@ If the password change is successful, the following message displays: - try { - $loginResponse = Invoke-RestMethod -Uri 'http://localhost:18083/api/v5/login' -Method Post -ContentType 'application/json' -Body '{"username": "admin", "password": "new-admin-password"}' - $token = $loginResponse.token @@ -292 +260,0 @@ If the password change is successful, the following message displays: - $addUserResponse = Invoke-RestMethod -Uri 'http://localhost:18083/api/v5/authentication/password_based%3Abuilt_in_database/users' -Method Post -ContentType 'application/json' -Headers @{"Authorization" = "Bearer $token"} -Body '{"password": "password-to-add", "user_id": "username-to-add"}' @@ -294,4 +262 @@ If the password change is successful, the following message displays: - $addUserResponse | ConvertTo-Json - } catch { - Write-Output "Failed to add user: $_" - } +###### To enable username and password authentication through EMQX Management using Windows @@ -299 +264 @@ If the password change is successful, the following message displays: -If the update is successful, a message similar to this appears: + 1. Change the admin password by running the following command: @@ -301,4 +266,34 @@ If the update is successful, a message similar to this appears: - { - "is_superuser": false, - "user_id": "your-added-username" - } + C:\greengrass\v2\bin\swe-emqx-cli.ps1 admin change-pwd + + 2. When prompted, do the following: + + 1. Enter your current administrator user (default is `admin`) and password (default is `public`). + + 2. Enter and confirm your new password. + +If successful, you see the following message: + + admin password changed successfully + + 3. Add users for external applications by running the following command: + + C:\greengrass\v2\bin\swe-emqx-cli.ps1 users add + + 4. When prompted, do the following: + + 1. Enter the username for the new user. + + 2. Enter and confirm the password for the new user. + +If successful, you see the following message: + + User '[username]' created successfully + + 5. Verify user configuration by running the following command: + + C:\greengrass\v2\bin\swe-emqx-cli.ps1 users list + +The output shows all configured users: + + Users: + - [your-added-username] @@ -306 +301 @@ If the update is successful, a message similar to this appears: -If the command fails, ensure that you're using the correct dashboard admin password that you updated in the previous step. + Total users: 1